005cc5fcee47af9761a6d41b5789683ad454ffa416a7bd7a9d3472ddf9fc230e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 02:27

Target

$PLUGINSDIR/FileInfo.dll
Size

589KB
MD5

96db521a774244bbab1de9d93d2b0a64
SHA1

27c8304e4b17a5a59d414de8ef77b056609c21bc
SHA256

f79eaaa02157d6f4cd44d3282ae039ced8ac9fac964ea4d7ed7c12ca92f5833c
SHA512

b0bc0e858e0a98c9c7e3f5479249fb4f9f6a92f7680fc437950e94499fe0dff3f778a8c2f8f0dd6d5d61fd9a209817bb59d3166d1f19d9adf1ee2153e00859c3
SSDEEP

12288:v1M3EgrfsgXqaW2SLHuOjcqUEETcw7/MvLhaQ1THqJe6A8UFNNP:v8EhGS3Q70vLY4TH+ej8UFfP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	2952	WerFault.exe	16

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2952	2116	rundll32.exe	16
PID 2116 wrote to memory of 2952	2116	rundll32.exe	16
PID 2116 wrote to memory of 2952	2116	rundll32.exe	16
PID 2116 wrote to memory of 2952	2116	rundll32.exe	16
PID 2116 wrote to memory of 2952	2116	rundll32.exe	16
PID 2116 wrote to memory of 2952	2116	rundll32.exe	16
PID 2116 wrote to memory of 2952	2116	rundll32.exe	16
PID 2952 wrote to memory of 2544	2952	rundll32.exe	17
PID 2952 wrote to memory of 2544	2952	rundll32.exe	17
PID 2952 wrote to memory of 2544	2952	rundll32.exe	17
PID 2952 wrote to memory of 2544	2952	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 220
    3⤵
    - Program crash
    PID:2544